CVE-2020-10212

CVE-2020-10212 concerns Responsive FileManager. The vulnerability is an SSRF in upload.php via the url parameter, affecting 9.13.4 and 9.14.0, with the issue rooted in how file-extension blocking is handled and DNS hostnames resolving to internal IPs; this is noted as a consequence of an incomple...

CVE-2020-10567

CVE-2020-10567 affects Responsive Filemanager up to version 9.14.0. The vulnerability is in ajax_calls.php, case 'save_img', where the name parameter’s extension is not validated. An attacker (often authenticated in affected apps like ZwiiCMS) can craft a JPEG with malicious EXIF data and a .php ...

CVE-2018-14728

CVE-2018-14728 affects Responsive FileManager 9.13.1 where the upload.php endpoint allows a server‑side request forgery (SSRF) via the parameter. The issue is documented in multiple sources (NVD entry for CVE‑2018‑14728 and the Nuclei template) and is classified as high/critical impact (NS: netw...

CVE-2022-44276

CVE-2022-44276 affects Responsive Filemanager prior to 9.12.0. The vulnerability allows bypassing upload restrictions in the file upload workflow, enabling remote code execution (RCE). Technical details from the PoC show exploitation via manipulated filenames and MIME-check logic (e.g., fix_filen...

CVE-2017-20145

CVE-2017-20145 affects Tecrail Responsive Filemanger up to version 9.10.x. The root cause is a path traversal vulnerability that enables remote access to files. Several connected sources corroborate a critical impact and indicate upgrading to version 9.11.0 as the fix. In at least one reference, ...